Jetty configuration wiki page and configuration to help mitigate clickjacking

[Cantor, Scott]

> In that JIRA you write "I did some research on CSP which I summarized for the
> committers." Are you able to share that information?

The summary was that it seemed like CSP in general was about to undergo a big shift and that the original spec was dead, but V2 wasn't going to be adopted, and V3 was the one that was likely to take over. That's from memory, I may have been wrong or may be misremembering. My impression was that the X-Frame-Options thing was superseded but that the replacement wasn't baked, so I wasn't sure what to do there.

The bulk of the CSP stuff seemed to be the move to ban inline JS, which turned portable, trivial one liner JS in the various forms into dozens of lines of non-portable insanity, or would force us to adopt JQuery everywhere, and my judgement was that it would be a huge step backward for the project and a net negative to security.

> Also is the proposed 3.4 functionality documented? I apologize if it is but I
> looked around and I cannot find it.

Possibly not, at the moment I think it's just a couple of additional properties I added. There's a filter added to web.xml and I put this in global-system, which defaults to setting X-Frame-Options and STS headers based on some properties, but allows additional headers from the deployer.

I misread it initially, I was thinking I had included a CSP header, but I was confusing that with STS. So in fact, I ran away screaming from CSP and I think what you wrote up doesn't really conflict with what I did, other than I provided a way to do it cross-container if you prefer.

If it's useful I could just add that CSP header in and define a property for that, I just didn't have much to default it to at the time. If the frame thing is baked, that would be a likely candidate.

-- Scott

    <bean id="shibboleth.DefaultResponseHeaderMap"
            class="org.springframework.beans.factory.config.MapFactoryBean">
        <property name="sourceMap">
            <map>
                <entry key="Strict-Transport-Security" value="max-age=%{idp.hsts.maxAge:0}" />
                <entry key="X-Frame-Options" value="%{idp.frameoptions:}" />
            </map>
        </property>
    </bean>

    <bean id="shibboleth.ResponseHeaderFilter"
        class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
        p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
        p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />